What "buy CVV online" means
CVV is the Card Verification Value. Visa, Mastercard and Discover print 3 digits on the back of the card. American Express prints 4 digits on the front and calls it CID. The code shows that the person holding the card also holds the physical card.
Search traffic for "buy cvv online" comes from two groups. One group wants to sell or buy stolen card numbers. That activity is card-not-present fraud. The other group wants to know how merchants check the code so their own card stays safe.
This page covers the second group.
The legal position
18 U.S.C. § 1029 covers fraud connected to access devices. A credit card number, and the CVV attached to it, counts as an access device. Buying, selling, transferring or holding card data with intent to defraud carries up to 10 years in prison for a first offense and up to 15 years for later offenses. Fines reach $250,000 for one individual.
18 U.S.C. § 1343 adds wire fraud charges when the transaction crosses state lines or uses the internet. Each count carries up to 20 years.
Sellers on those marketplaces
Researchers who monitor carding forums report one pattern. A large share of listings are fabricated numbers or numbers already blocked by the issuer. Buyers who pay in cryptocurrency have no recourse. Some forums harvest the buyer's own device data at signup.
There is no consumer protection on these sites. No chargeback. No refund.
How a merchant checks a CVV
- The customer enters card number, expiry date and CVV at checkout.
- The payment gateway sends the data to the issuer through the card network.
- The issuer returns an authorization code plus a CVV result: match, no match, or not processed.
- The merchant stores the result, not the code.
PCI DSS Requirement 3.2 bars storage of the CVV after authorization. Sensitive authentication data cannot be kept, even in encrypted form.
Merchants pair the CVV check with Address Verification Service. AVS compares the billing street number and ZIP code against issuer records. A CVV match plus an AVS match lowers fraud risk. A CVV mismatch on a high-value order is a signal to stop the sale.
Liability rules
Card network rules shift chargeback liability to the merchant when the merchant did not verify the CVV. That is the reason most US e-commerce sites require the code. A merchant that skips the check pays for the fraud.
Protecting your own CVV
- Never give the code over a phone call you did not start.
- Type the number on sites with a valid TLS certificate. Check the address bar.
- Use a virtual card number from your issuer for subscriptions and unfamiliar stores.
- Turn on transaction alerts. Issuers send a text for each charge above a set amount.
- Report a lost card within 24 hours. Federal law caps your liability at $50 for unauthorized use.
Pitfalls to avoid
Sites that sell CVV data promise a fullz bundle or a card with a high balance. There is no way to confirm the data before payment. The listing price, often $5 to $50 per card, sits below the cost of a single chargeback. That gap is the tell.
Any page that asks you to pay for card data is a scam or a criminal marketplace. Both outcomes cost money. The second outcome also carries prosecution risk.
If your card data leaked
Call the issuer. Ask for a new card number. Review statements for 12 months. File a report at IdentityTheft.gov and, for losses above $1,000, at the FBI Internet Crime Complaint Center.